High performance data message capture method and device based on Linux

Abstract

The invention relates to the technical field of networks, in particular to a high performance data message capture method and device based on Linux. The method comprises the steps that a data message capture program is notified to process a trigger signal in an interruption mode according to the trigger signal; the trigger signal is shielded if network flow is large, and a network card is initiatively polled on whether a data message is received; if the data message is received, the data message of the network card is synchronized to kernel memory; if the network flow is small, correspondence to the trigger signal is performed, and the data message of the network card is synchronized to the kernel memory; a data message storage address in the kernel memory is obtained, and the storage starting address of the data message is mapped to user virtual address space through the memory mapping function mmap. Kernel interrupt processing is reduced through a semi-polling method, a path for transmitting the data message of the network card is changed, copy frequency of the data message is reduced through the memory mapping function mmap, high performance network sniffing is conducted under the gigabit and 10 gigabit environment, packet loss rate is reduced, and CPU occupation rate is reduced.

Description

technical field [0001] The invention relates to the field of network technology, in particular to a method and device for capturing high-performance data packets based on Linux. Background technique [0002] Data packet capture is to use the promiscuous mode of the network card to capture all data packets passing through the network card, and then provide them to the application for specific purposes, such as analysis of network failures, evaluation of network quality, or firewall and log system accomplish. The biggest advantage of implementing these applications by means of data packet capture is that while capturing all data packets passing through the network card, it also provides the application with the most original data packets. [0003] High-performance data packet capture specifically refers to network packet capture in a Gigabit or 10 Gigabit environment. The network in this environment is characterized by large traffic and many data packets, which can reach mill...

AI Technical Summary

Problems solved by technology

It can be seen that frequent data copying, kernel interrupt processing and system calls will make the CPU usage rate extremely high, resulting in low efficiency and increased packet loss rate.

Images